[
https://issues.apache.org/jira/browse/DERBY-7147?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17799918#comment-17799918
]
Richard N. Hillegas commented on DERBY-7147:
--------------------------------------------
I am mystified by the high rating which NVD analysts gave to this minor
security issue: https://nvd.nist.gov/vuln/detail/CVE-2022-46337
There are no plans to produce patch-bearing official releases for LTS Java
versions 8, 11, or 17. Users who must remain on those Java versions will need
to build their own Derby jars from, respectively, the heads of the 10.14,
10.15, and 10.16 branches.
> LDAP injection vulnerability in LDAPAuthenticationSchemeImpl
> ------------------------------------------------------------
>
> Key: DERBY-7147
> URL: https://issues.apache.org/jira/browse/DERBY-7147
> Project: Derby
> Issue Type: Bug
> Components: JDBC
> Affects Versions: 10.16.1.1
> Reporter: Richard N. Hillegas
> Assignee: Richard N. Hillegas
> Priority: Major
> Fix For: 10.14.3, 10.15.2.1, 10.16.1.2, 10.17.1.0
>
> Attachments: LDAPauthenticationVulnerability.pdf,
> derby-7147-01-aa-reformatForReadability.diff,
> derby-7147-02-aa-escapeLDAPsearchFilter.diff,
> derby-7147-02-ab-escapeLDAPsearchFilter.diff,
> derby-7147-03-aa-updateLDAPinstructions.diff,
> derby-7147-03-aa-updateLDAPinstructions.tar,
> derby-7147-03-ab-updateLDAPinstructions.diff,
> derby-7147-03-ab-updateLDAPinstructions.tar,
> derby-7147-04-aa-pointLDAPTestAtInstructions.diff, releaseNote.html
>
>
> An LDAP injection vulnerability has been identified in
> LDAPAuthenticationSchemeImpl.getDNFromUID(). An exploit has not been
> provided, but there is a possibility that an intruder could bypass
> authentication checks in Derby-powered applications which rely on external
> LDAP servers.
> For more information on LDAP injection, see
> https://www.synopsys.com/glossary/what-is-ldap-injection.html
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
